Forum Discussion

GuruLee's avatar
GuruLee
Brass Contributor
Jan 31, 2024

Export Log Analytics Workspace for Timespan Locally with PowerShell

I need to export all log analytics workspace data locally for a given date range or last 30 days. I tried this PS script:   $startTime = (Get-Date).AddDays(-21) $endTime = Get-Date $outputPath = "...
azure
Windows PowerShell
GuruLee's avatar
GuruLee
Brass Contributor
Feb 01, 2024

LainRobertson I checked my instances/versions, and this is what I have:

\PS C:\Windows\system32> Get-Command -Name Invoke-AzOperationalInsightsQuery

CommandType     Name                                               Version    Source                              
-----------     ----                                               -------    ------                              
Cmdlet          Invoke-AzOperationalInsightsQuery                  3.2.0      Az.OperationalInsights

 I tried re-running my cmdlet/script using either workspaceID or workspace and I still get errors:

 

LainRobertson's avatar
LainRobertson
Silver Contributor
Feb 01, 2024

GuruLee 

 

Hi, Lee.

 

I clearly wasn't paying close enough attention initially, as I've only just noticed that we're not dealing with the "official" commandlet, Invoke-AzOperationalInsightsQuery, but rather the community-authored commandlet (albeit written by a Microsoft employee) Invoke-AzOperationalInsightsQueryExport. I'd been referring to the former, being part of the Az.OperationalInsights module.

 

So, now that I've spotted my oversight, let's try again.

 

The two commands do not share precisely the same parameter names:

 

 

Invoke-AzOperationalInsightsQuery supports these parameters:

 

  • WorkspaceId
  • Workspace
  • Timespan

 

While Invoke-AzOperationalInsightsQueryExport supports:

 

  • WorkspaceName
  • Interval

 

So, getting back to your screenshot of errors, the first error is accurate as these parameters you have used do not exist for Invoke-AzOperationalInsightsQueryExport:

 

  • Workspace
  • StartTime
  • EndTime
  • OutputPath

 

It's a similar story for the second error, where there is no parameter named WorkspaceId, either.

 

The Microsoft commandlet is the more powerful of the two, with the community commandlet being more a "convenience" commandlet that has less flexibility (which is a common trade-off with convenience commandlets).

 

With the Microsoft commandlet, you can indirectly specify a duration via the -Timespan parameter using this format:

 

 

-Timespan (New-TimeSpan -Days 30)

 

 

Given that Invoke-AzOperationalInsightsQueryExport is a community module that hasn't been updated since April 2020, my personal preference would be to work with the Microsoft-native commandlet instead.

 

Cheers,

Lain

Resources